Secunia Research has discovered a vulnerability in Novell GroupWise,
which can be exploited by malicious people to cause a DoS (Denial of
Service).

Novell GroupWise includes the GroupWise Internet Agent (GWIA), which
is responsible for exchanging e-mail messages between GroupWise and
the Internet via e.g. IMAP4, POP3, and SMTP. The GroupWise Internet
Agent also supports parsing of iCalendar data, which is implemented
in gwwww1.dll.

The iCalendar format is used to exchange calendar information and is
comprised of various groupings of component properties. Some of these
properties may include date-time information, which can e.g. be
specified via the TZID parameter of a DTSTART property in a VTIMEZONE
component. Date-Time information is formatted as: "[date]T[time]"
where "[date]" is 8 characters and "[time]" is 6 characters (e.g.
"20120915T230000" means September 15th, 2012 at 11 PM).

NgwiCalTimeProperty::datetime() in gwwww1.dll is responsible for
parsing date-time information. When called, the function in turn calls
NgwiCalTimeProperty::date() to parse the date in the date-time string.
Upon exiting, NgwiCalTimeProperty::date() returns a pointer to offset
8 into the date-time string (i.e. where the 'T' and following time
information is expected to be). This returned pointer is then
dereferenced in order to evaluate whether the referenced character is
'T' and parse the expected time information.

However, no checks are performed by the function to ensure that the
supplied date-time string is longer than 8 characters. This may result
in an out-of-bounds read access violation, causing GWIA to crash in
case a shorter date-time string was supplied via e.g. an e-mail with
a specially crafted .ics attachment.